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Amendments to the specificaiton 

Please replace the paragraph at page 23, line 17 - page 24, line 17 with the following paragraph. 

• A process satisfies the A aB formula if and only if it satisfies both the A and the B formula. 

• A process satisfies the A =>B formula if and only if either it does not satisfy the A formula 
or it satisfies the B formula. 

• A process satisfies the A <=>B formula if and only if it satisfies neither or both the A and B 
formulas. 

• A process P satisfies the A'liA" formula if and only if for every decomposition of P into 
processes F and P" such that P = F\F\ either F satisfies A* or P" satisfies A". 

• A process P satisfies the !A formula if and only if every parallel component F of P (such 
that P = F\F\ including F = 0) satisfies the A formula. 

• A process P satisfies the ?A formula if and only if there is a parallel component F of P 
(such that P = F\F') that satisfies the A formula. 

• A process P satisfies the formula Vw.A if and only if for every name m, P satisfies A{/i<- 
m}. 

• A process P satisfies the formula 3^A if and only if A holds at every location F within P, 
where "sublocation" is defined by Pi'^F. 

• A process P satisfies the formula dA if and only if A holds in the future for every residual 
F of P, where "residual" is defined by P->*P. 

• A process P satisfies the formula A @ i f and only if when placed in any ambient n, the 
combination n[P] satisfies A. 

• A process P satisfies the formula >A if and only if for every process (i.e., for every 
context) the combination of P and with that process satisfies A. 

• If process P satisfies the formula A>B, it means that in every context that satisfies A, the 
combination (of P and the context) satisfies B. Instead, if process P satisfies the formula 
>(A=>B), it means that in every context, if and only if the combination satisfies A then the 
combination satisfies B. 
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Please replace the paragraph at page 28, line 9 with the following paragraph. 




(0) 


/-T-t= } OA Hh-^ -.D-iA 




i-X-t= ^ -C^^A -\\-c^- , M -.A 


(□K) 


/^t=i dCA => B) (nA ^ dB) 


(HK) 


AT-t=i M(A=>B)h^(wA=>HB) 


(□T) 


y^t=inAh^A 


(HT) 




(□4) 


*^t=i DAh^ oak 


(H4) 


A*-t=i HAh^ hhA 


(□hM) 


AhBi/nAhoB 


(HhM) 


AhB}/ nAhHB 


(□A) 


□(AA()l-B//aAAo(l-B 


(Ha) 


H(AA()hB// HAAtKhB 


(□V) 


Ahn((vB)//AhoCvnB 


(H V) 


Ah H((vB)//Al- h(vhB 



Please replace the paragraph at page 34, Hnes the following paragraph 



In 308 specifically, all of the names of the process are determined. Then, it is verified 
that a name exists for the formula that is unequal to any of the names of the process. If this 
verification fails, then the process itself fails against the policy. The check of 308 only applies if 
the formula is an existential quantification V3. A. This check can be expressed as: 




Please replace the paragraph at page 34, line 1 1 with the following paragraph. 



ChecHP, V3x.A) @ let {mu mk}= fn{P)\jfn{k) in 

let g { mp . . . , } be some fresh name in 

T if CAec/: (P, A (x <-mJ) for some /eO../: 
F otherwise 
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